fix(desktop): harden packaged Electron

packages/desktop/electron-builder.config.test.ts

@@ -103,6 +103,19 @@ for (const channel of channels) {
   })
 }
 
+test("hardens the packaged Electron runtime", async () => {
+  const config = (await import("./electron-builder.config.ts?electron-fuses")).default as Configuration
+
+  expect(config.electronFuses).toEqual({
+    runAsNode: false,
+    enableNodeOptionsEnvironmentVariable: false,
+    enableNodeCliInspectArguments: false,
+    enableEmbeddedAsarIntegrityValidation: true,
+    onlyLoadAppFromAsar: true,
+    grantFileProtocolExtraPrivileges: false,
+  })
+})
+
 test("the trimmed Zip.js package can still export compressed logs", async () => {
   const config = (await import("./electron-builder.config.ts")).default
   const dir = await mkdtemp(path.join(os.tmpdir(), "opencode-zip-package-"))

packages/desktop/electron-builder.config.ts

@@ -68,6 +68,14 @@ const getBase = (appId: string): Configuration => ({
   extraMetadata: {
     desktopName: `${appId}.desktop`,
   },
+  electronFuses: {
+    runAsNode: false,
+    enableNodeOptionsEnvironmentVariable: false,
+    enableNodeCliInspectArguments: false,
+    enableEmbeddedAsarIntegrityValidation: true,
+    onlyLoadAppFromAsar: true,
+    grantFileProtocolExtraPrivileges: false,
+  },
   files: [
     "out/**/*",
     "resources/**/*",